Skip to content

fix: accurate rate-limit schema descriptions and DefaultConfig consistency#112

Merged
intel352 merged 2 commits intofix/api-gateway-rate-limiter-isolationfrom
copilot/sub-pr-103
Feb 23, 2026
Merged

fix: accurate rate-limit schema descriptions and DefaultConfig consistency#112
intel352 merged 2 commits intofix/api-gateway-rate-limiter-isolationfrom
copilot/sub-pr-103

Conversation

Copy link
Contributor

Copilot AI commented Feb 23, 2026

The requestsPerMinute field description incorrectly stated the two rate fields were "mutually exclusive", while the actual implementation gives requestsPerHour precedence. The DefaultConfig was also missing requestsPerHour, diverging from the ConfigFields definition.

Changes

  • plugins/http/schemas.go
    • requestsPerMinute description: "mutually exclusive with requestsPerHour""used when requestsPerHour is not set"
    • DefaultConfig: added "requestsPerHour": 0 to match the ConfigFields entry

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

…ate limit schema

Co-authored-by: intel352 <77607+intel352@users.noreply.github.com>
Copilot AI changed the title [WIP] Fix clarify APIGateway rate limiter is instance-scoped fix: accurate rate-limit schema descriptions and DefaultConfig consistency Feb 23, 2026
Copilot AI requested a review from intel352 February 23, 2026 06:38
@intel352 intel352 marked this pull request as ready for review February 23, 2026 06:46
@intel352 intel352 merged commit 79c450e into fix/api-gateway-rate-limiter-isolation Feb 23, 2026
@intel352 intel352 deleted the copilot/sub-pr-103 branch February 23, 2026 06:46
intel352 added a commit that referenced this pull request Feb 23, 2026
…103)

* security: add algorithm pinning tests for JWT confusion attacks (closes #95)

Verified that all JWT validation paths in JWTAuthModule already enforce
HS256 via both type assertion (*jwt.SigningMethodHMAC) and explicit
algorithm check (token.Method.Alg() != jwt.SigningMethodHS256.Alg()).

Added tests to module/jwt_auth_test.go that explicitly confirm tokens
signed with HS384 or HS512 are rejected by:
- Authenticate() — the AuthProvider interface method
- handleRefresh via Handle() — the /auth/refresh endpoint
- extractUserFromRequest via Handle() — all protected endpoints

The api package (middleware.go, auth_handler.go) already had equivalent
algorithm rejection tests in auth_handler_test.go.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* docs: document 10+ undocumented module types in DOCUMENTATION.md (closes #66)

Adds detailed documentation for audit logging, license.validator,
platform.provider/resource/context, observability.otel, step.jq, AI
pipeline steps (ai_complete, ai_classify, ai_extract), CI/CD steps
(docker_build, docker_push, docker_run, scan_sast, scan_container,
scan_deps, artifact_push, artifact_pull), and the admincore plugin.
Each entry includes config field tables with types and defaults, plus
a minimal YAML example. Summary tables in the module type index are
also updated with the new Infrastructure and CI/CD Step categories.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* security: add strict per-IP rate limiting to auth endpoints (closes #94)

- Add dedicated rate-limit middleware modules for login (10/min) and
  register (5/hour) in admin/config.yaml, replacing the shared global
  limiter that allowed 120 req/min on sensitive auth endpoints
- Extend RateLimitMiddleware to support fractional rates via float64
  token buckets, enabling hourly rate configs without precision loss
- Add NewRateLimitMiddlewareWithHourlyRate constructor and factory
  support for requestsPerHour config key
- Add requestsPerHour field to the http.middleware.ratelimit schema
- Add tests for hourly rate middleware and per-hour factory config

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix: clarify APIGateway rate limiter is instance-scoped, not global (closes #61)

- Rename field globalLimiter -> instanceRateLimiter to make scope clear
- Rename SetGlobalRateLimit -> SetRateLimit; keep SetGlobalRateLimit as
  a deprecated alias so existing callers continue to work
- Add APIGatewayOption + WithRateLimit() functional option for DI at
  construction time (preferred over the setter)
- Document on the struct that rate limiter state is never shared across
  instances, so multi-tenant deployments are not affected
- Add TestAPIGateway_InstanceRateLimit_WithRateLimit and
  TestAPIGateway_InstanceRateLimiters_AreIsolated to cover the new
  option and prove per-instance isolation

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix: update caller to use renamed SetRateLimit method

Update plugins/api/plugin.go to call SetRateLimit instead of the
deprecated SetGlobalRateLimit, fixing staticcheck lint failure.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix: accurate rate-limit schema descriptions and DefaultConfig consistency (#112)

* Initial plan

* fix: clarify requestsPerHour precedence and add to DefaultConfig in rate limit schema

Co-authored-by: intel352 <77607+intel352@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: intel352 <77607+intel352@users.noreply.github.com>

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com>
Co-authored-by: intel352 <77607+intel352@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants